PCI DSS v4.0.1 Self-Assessment Questionnaire (SAQ D for Merchants)

Why does it matter?

SAQ D is where a merchant ends up when its payment environment is too broad for the targeted questionnaires: a website that collects card numbers itself, electronic storage of account data, or a mix of channels and systems that no shorter SAQ describes. Because it carries every PCI DSS requirement, the work of scoping, segmentation and deciding what is Not Applicable matters more here than in any other SAQ, and the Council devotes most of its front matter to those decisions. The result for the merchant is a single document that, once complete, states in Part 3 whether it is Compliant, Non-Compliant or Compliant but with Legal exception for the whole assessed environment.

Key benefits include:

• Eligibility by exclusion

SAQ D applies to merchants eligible to complete an SAQ that do not meet the criteria for any other SAQ type; the four examples in the Merchant Eligibility Criteria include e-commerce sites that accept account data and merchants with electronic storage.

• Every requirement in one form

Section 2 covers Requirements 1 to 12 in the Council's six goal groups, and Appendix A2 covers POS POI terminals using SSL or early TLS; Part 2g of the AOC summarizes the responses for each.

• Not Applicable must be proven

A requirement is Not Applicable only after verification: to mark the wireless requirements 1.3.3, 2.3.1, 2.3.2 and 4.2.1.2 Not Applicable the merchant first confirms that no wireless technology is used in or connects to its cardholder data environment, and every such answer is explained in Appendix C.

• Partial assessments are possible

Not Tested is available when a requirement was excluded without consideration, for example when the acquirer asks for validation of Prioritized Approach milestones only; each is explained in Appendix D and the assessment is declared Partial in Section 3.

• Future-dated items handled

Requirements marked as best practice until March 31, 2025 could be reported Not Applicable before that date if not yet implemented; after it they are required and must be fully considered in the assessment.

How does it work?

Section 1, Assessment Information, is Parts 1 and 2 of the AOC. Part 1 identifies the assessed merchant and any assessor; Part 2 records the payment channels assessed and any excluded (2a: mail order or telephone order, e-commerce, card-present), how the business stores, processes or transmits account data per channel (2b), a description of the environment and whether segmentation reduces scope (2c), in-scope facilities (2d), any items from the PCI SSC Lists of Validated Products and Solutions with their listing numbers and expiry dates (2e), third-party service providers, to all of which Requirement 12.8 applies (2f), and the Summary of Assessment with one row per requirement and one for Appendix A2 (2g).

Section 2 reproduces each PCI DSS requirement with an Expected Testing column (examine, observe, interview) and five possible responses: In Place, In Place with CCW, Not Applicable, Not Tested and Not in Place. The Guidance for Not Applicable Requirements gives the examples the Council expects: no wireless technology, no electronic storage of account data (so Requirement 3.5.1 falls away), and no bespoke or custom software (so 6.2.1 to 6.2.4 do not apply). Compensating controls need the worksheet in Appendix B. A legal restriction is reported as Not in Place with an attestation in Part 3; contractual obligations and legal advice do not count as legal restrictions. The customized approach cannot be documented in an SAQ.

The completion steps are to confirm from the eligibility criteria and the SAQ Instructions and Guidelines that SAQ D is the correct form, confirm the environment is properly scoped, assess it, complete Sections 1, 2 and 3, and submit the SAQ and AOC with any requested documentation such as ASV scan reports to the acquirer or payment brand. Section 3 opens with the Full or Partial declaration, then the compliance status, the acknowledgement that SAQ D Version 4.0.1 was completed per its instructions (3a), the merchant executive officer signature (3b), QSA and ISA involvement (3c and 3d) and, on request after a Non-Compliant result, the Part 4 action plan with remediation dates for Requirements 1 to 12.

Key Elements

• Merchant Eligibility Criteria

Merchants eligible to self-assess that meet no other SAQ type, with four worked examples; not applicable to service providers.

• Section 1: Assessment Information

AOC Parts 1 and 2, including the segmentation question in Part 2c, validated products with expiry dates in Part 2e and the TPSP list in Part 2f.

• Section 2: Requirements 1 to 12

Build and maintain a secure network and systems (1, 2); protect account data (3, 4); maintain a vulnerability management program (5, 6); implement strong access control measures (7, 8, 9); regularly monitor and test networks (10, 11); maintain an information security policy (12).

• Appendix A2: SSL and early TLS at POS POI terminals

A2.1.1 requires a merchant whose POS POI terminals use SSL or early TLS to confirm they are not susceptible to known exploits; A2.1.2 and A2.1.3 are for service providers only. Appendix A1 is not used for merchant assessments and A3 applies only to designated entities.

• Not Applicable and Not Tested

Not Applicable is verified and explained in Appendix C; Not Tested means excluded without consideration, is explained in Appendix D and makes the assessment Partial.

• Section 3: Validation and Attestation

Full or Partial; Compliant, Non-Compliant or Compliant but with Legal exception; acknowledgement, signatures and the Part 4 action plan.

• Supporting documentation

ASV scan reports and whatever else the requesting organization asks for travel with the SAQ and AOC (completion step 5).

What does it cover?

SAQ D for Merchants applies to any merchant payment environment that an acquirer or payment brand allows to be self-assessed and that fits no other SAQ: typically e-commerce sites that receive account data, merchants storing account data electronically, and merchants with several channels or additional applicable requirements. The merchant declares in Part 2a which channels the assessment covers and must consult the entity receiving the AOC about validation of any channel left out. Service providers are excluded and use SAQ D for Service Providers. Whether a merchant may self-assess at all, rather than engage a Qualified Security Assessor for a Report on Compliance, is decided by the payment brands and acquirers that run the compliance programs.

What are its objectives?

The questionnaire is built to let a merchant with a broad environment show that:

Scope is correct: the cardholder data environment, its connections and any segmentation are described in Parts 2c and 2d before a requirement is answered.

Every one of the twelve requirements has been tested, or its exclusion has been verified (Not Applicable, Appendix C) or declared (Not Tested, Appendix D).

Compensating controls, legal restrictions and future-dated requirements are reported in the way the front matter prescribes.

Third-party service providers are listed in Part 2f and managed under Requirement 12.8.

The outcome is attested by a merchant executive officer and, if Non-Compliant, backed by a dated action plan in Part 4.

Framework in Context

SAQ D for Merchants is the fallback in the Council's set of merchant questionnaires: SAQ A, A-EP, B, B-IP, C, C-VT and P2PE each describe one narrow environment, and a merchant that meets none of their criteria, or meets them but has extra applicable requirements, uses SAQ D. Its content is the full PCI DSS v4.0.1 standard (June 2024) in questionnaire form, so a merchant moving from a Report on Compliance to self-assessment, or the other way, works from the same requirement numbers. The Council published it on October 15, 2024 alongside the SAQ Instructions and Guidelines document, which explains the intent of every SAQ, the eligibility criteria and how to complete one.

Common Framework Mappings

Because SAQ D contains the whole of PCI DSS, merchants with an established security program map it requirement by requirement so that existing controls, owners and evidence can be reused for the annual attestation and for their other audits. The list below is indicative only; the acquirer assesses the completed SAQ and AOC, not the mapping.

Mapped frameworks include:

ISO 27001:2022

ISO 27002:2022

NIST CSF 2.0

NIST 800-53 Rev.5

PCI DSS 4.0.1

SOC 2